HIGH 8.7 NVD
CVE-2026-84485
APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve me
APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hierarchy. Attackers can query the endpoint with space identifiers obtained from shared links or public templates to enumerate the complete member directory of any workspace.
References
- https://github.com/apitable/apitable
- https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend
- https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend
- https://github.com/apitable/apitable/blob/88b24ce9f359cc434778be75d03603182882dc76/backend
- https://www.vulncheck.com/advisories/apitable-through-1.13.0-beta.1-missing-authentication
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-09-02 via NVD.
vulnfeed aggregates 11552 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.